I've been writing about technology for most of my adult life, focusing mainly on legal and regulatory issues. I write for a wide range of publications: credits include the Times, Daily Telegraph and Financial Times newspapers, as well as BBC radio and numerous technology titles. Here, I'll be covering the ways content is controlled on the internet, from censorship to online piracy and copyright. You can follow my posts by clicking the '+ Follow' button under my name.

How Europe's Right To Be Forgotten Affects Your Business

Yesterday, GoogleGoogle started pulling certain search results to comply with the recent EU ruling on the ‘right to be forgotten’, allowing individuals to ask for the removal of links to personal information.

The move follows a European Court of Justice ruling last month that Google and other search engines are data controllers, and therefore responsible for the content that they display. As such, they’re subject to the Data Protection Directive, meaning that they are required to remove links that are “inadequate, irrelevant or no longer relevant”.

Google is struggling to deal with the workload, having received over 41,000 requests in the first four days alone. It’s now updated its technical infrastructure, started ploughing through the backlog, and is implementing successful requests.

But the decision has implications for other businesses too. Google had argued that, because it didn’t control the information on the sites it linked to, it wasn’t a data controller. But the court saw things differently. Because the company “determined the purposes and means of the processing of personal data”, then it is a data controller, the judges ruled.

“The practical upshot is that a business does not have to have control over the information itself in order to be considered a data controller for the purposes of the directive,” says Richard Beavan, a partner with law firm Boodle Hatfield. “All that is necessary is for the business to have some control over when and where the data is displayed.”

This, then, is a ruling that could affect many more businesses than the search engines on which so much attention has been focused. Social media sites are an obvious example; but other businesses, too, could be subject to the rules. While journalistic sites are specifically excepted from the ruling, blogs may well not be – and many other websites contain search features or external links.

Even private individuals may find themselves in the position of data controllers. There’s an exception in the law for the “processing of personal data by a natural person, without any gainful interest, in the course of his or her own exclusively personal or household activity”. However, the key word here is “exclusively” – public posts may not comply.

In a paper, Kathryn Smith of Monash University’s Faculty of Law gives the example of a Facebook user who posts unflattering pictures of a friend on the site. “Ben decides to take photographs of Amy drinking and partying on his mobile phone, and uploads them immediately to Facebook,” she writes.

“Ben chooses the audience to which the photographs are viewable: he can even make the photographs publicly accessible, allowing them to be indexed by search engines such as Google. Ben chooses whether or not he will notify Amy of the photographs through a ‘tag’, and he chooses how to caption the photograph.”

In practice, it’s likely to be the social network itself that carries the can in such cases involving private individuals: Facebook, for example, could extend its existing takedown process to automatically remove disputed photos.

But this doesn’t let everybody off the hook: under the regulations, Facebook users may be regulated as data controllers if they receive a “gainful interest” – a description that could clearly apply to brands.

Part of the judgement hinged on whether Google is “established” in the EU – the company claimed that it wasn’t, on the basis that its servers are in the US. But, ruled the court, its data was being processed “in the context of the activities of Google Spain”, because Google Spain promotes and sells advertising space offered by Google Inc. And the same argument will apply to many non-EU businesses that could previously have thought they were in the clear.

There’s a distinct lack of clarity about the ruling, which will likely lead to more legal disputes. However, the EU is currently debating a new EU General Data Protection Regulation that will replace the current directive, extending the territorial reach of EU data protection laws to make it clear that they apply no matter where EU residents’ personal data is collected. Companies need to be prepared.

Post Your Comment

Post Your Reply

Forbes writers have the ability to call out member comments they find particularly interesting. Called-out comments are highlighted across the Forbes network. You'll be notified if your comment is called out.